docs: publish the v1 beta evidence

Publish the exact-candidate Windows and Linux results, signed-tag and clean-install status, provisional macOS boundary, and reliable runtime-first Beta 1 installation order. The post-publication verifier now cleans read-only module caches safely.

This commit is an exact sanitized export from the private development record. Material drafting and review were assisted by OpenAI Codex; Cole Speelman reviewed the changes and accepts human responsibility.

Signed-off-by: Cole Speelman <crspeelman@gmail.com>

scripts/README.md

@@ -8,7 +8,7 @@ These scripts are intentionally understandable shell and PowerShell rather than
 - `verify.ps1` provides the equivalent native Windows lane; pass `-Race` to include the race detector.
 - `check-licenses.sh` enforces the AGPL compiler / Apache runtime boundary and prevents generated application Go from inheriting an AGPL identifier.
 - `release-check.sh --version vX.Y.Z` is a clean-checkout technical preflight, including exact candidate-version and generated-provenance checks. Beta publication follows the narrower prerelease gates in `RELEASE.md`; release candidates and final v1 additionally use `--public` with a human-reviewed `HIMESAN_RELEASE_EVIDENCE_DIR`. The script never tags, pushes, publishes, or deploys.
-- `verify-public-install.sh --version vX.Y.Z` is a post-tag/publication check. It verifies exact `go-get=1` package routes and runs the documented compiler install and runtime get from fresh direct-fetch and public-proxy caches without interactive Git credentials.
+- `verify-public-install.sh --version vX.Y.Z` is a post-tag/publication check. It verifies exact `go-get=1` package routes, adds the nested runtime before installing the parent compiler, and exercises fresh direct-fetch and public-proxy caches without interactive Git credentials.
 
 The canonical Linux CI and release preflight also run bounded fuzz sessions for the parser/context compiler and Go-aware delimiter scanner. Seed-corpus execution remains part of ordinary `go test`; the bounded sessions are extra evidence, not a substitute for longer scheduled fuzzing before v1.
 

scripts/verify-public-install.sh

@@ -103,6 +103,7 @@ fi
 scratch_dir=$(mktemp -d "${TMPDIR:-/tmp}/himesan-public-install.XXXXXXXX")
 cleanup() {
 	if [[ -n "${scratch_dir:-}" && -d "$scratch_dir" ]]; then
+		chmod -R u+w -- "$scratch_dir" 2>/dev/null || true
 		rm -rf -- "$scratch_dir"
 	fi
 }
@@ -116,7 +117,29 @@ run_install_pair() {
 	local installed_binary installed_version go_executable_suffix
 	mkdir -p "$mode_dir/gopath" "$mode_dir/modcache" "$mode_dir/buildcache" "$mode_dir/consumer"
 
-	printf '\n==> %s clean-cache install\n' "$mode"
+	printf '\n==> %s clean-cache runtime then compiler install\n' "$mode"
+	(
+		cd "$mode_dir/consumer"
+		go mod init example.invalid/himesan-public-install >/dev/null
+		env \
+			GIT_TERMINAL_PROMPT=0 \
+			GIT_CONFIG_NOSYSTEM=1 \
+			GIT_CONFIG_GLOBAL=/dev/null \
+			GIT_ASKPASS="$false_command" \
+			SSH_ASKPASS="$false_command" \
+			GOPATH="$mode_dir/gopath" \
+			GOMODCACHE="$mode_dir/modcache" \
+			GOCACHE="$mode_dir/buildcache" \
+			GOPROXY="$proxy" \
+			GOPRIVATE= \
+			GONOPROXY=none \
+			GONOSUMDB="$no_sum_db" \
+			GOSUMDB=sum.golang.org \
+			GOINSECURE= \
+			GOAUTH=off \
+			go get "gamertan.com/sandwich-hime/sando@$version"
+	)
+
 	env \
 		GIT_TERMINAL_PROMPT=0 \
 		GIT_CONFIG_NOSYSTEM=1 \
@@ -154,28 +177,6 @@ EOF
 		printf 'error: generated provenance did not record installed compiler version %s\n' "$version" >&2
 		exit 1
 	fi
-
-	(
-		cd "$mode_dir/consumer"
-		go mod init example.invalid/himesan-public-install >/dev/null
-		env \
-			GIT_TERMINAL_PROMPT=0 \
-			GIT_CONFIG_NOSYSTEM=1 \
-			GIT_CONFIG_GLOBAL=/dev/null \
-			GIT_ASKPASS="$false_command" \
-			SSH_ASKPASS="$false_command" \
-			GOPATH="$mode_dir/gopath" \
-			GOMODCACHE="$mode_dir/modcache" \
-			GOCACHE="$mode_dir/buildcache" \
-			GOPROXY="$proxy" \
-			GOPRIVATE= \
-			GONOPROXY=none \
-			GONOSUMDB="$no_sum_db" \
-			GOSUMDB=sum.golang.org \
-			GOINSECURE= \
-			GOAUTH=off \
-			go get "gamertan.com/sandwich-hime/sando@$version"
-	)
 }
 
 run_install_pair direct direct gamertan.com/sandwich-hime